HarfangLab
HarfangLab is a Paris-based European cybersecurity company founded in 2018 that sells EDR, EPP, and attack surface management software exclusively through an MSSP partner network to European enterprises and government buyers prioritizing data sovereignty.
- Company typePrivate
- Founded2018
- HeadquartersParis, France
- Headcount51–100
- GTM typeB2B
- OfferingSoftware
What HarfangLab does
HarfangLab is a Paris-headquartered European cybersecurity company founded in 2018 that develops endpoint detection and response (EDR), endpoint protection platform (EPP), and attack surface management (ASM) software for workstations and servers running Windows, Linux, and macOS. The platform is built with a Rust-based lightweight agent (~250 MB RAM, ~1% CPU) that performs detection directly on endpoints using a stack of proprietary engines: YARA signatures, Sigma behavioral rules mapped to MITRE ATT&CK, IOC scanning, the Ransomguard ransomware engine, the Sidewatch DLL-sideloading engine, the Ashley ML/DL engine for unknown threat detection, and the Kio generative AI assistant that responds to SOC analyst queries in natural language. Both Cloud and On-Premises deployments are supported with full feature parity, including air-gapped environments, and the API-first architecture integrates broadly with SIEM, SOAR, threat intelligence, and identity stacks.
The company sells exclusively through an MSSP partner network (100% indirect) spanning France, Benelux, DACH, Italy, Spain, Scandinavia, and the Middle East, with Elite tier partners including Orange Cyberdefense, Thales Cyber Solutions, Capgemini, Axians, and Advens. Plans are structured as tiered subscriptions (Scout/ASM, Shield/EPP, Track/EDR) with bundle options (Harfang One, Guard), priced per endpoint on multi-year contracts. HarfangLab has obtained the ANSSI CSPN certification (first EDR, 2020, renewed and extended in 2024), ANSSI Qualification (December 2024), the BSI BSZ certification in Germany (first EDR, 2025), and PCI-DSS compliance for its On-Premises deployment, anchoring its go-to-market around European data sovereignty, government-grade certification, and open transparent detection rules in YARA and Sigma formats. Named customers span Orange, defense industry SOCs, Thales/Safran/Nexter-adjacent retail group, Brest University Hospital, Université Paris Cité, and a French Department, with a Gartner Peer Insights rating of 4.9/5.
HarfangLab firmographics
Firmographics- Name
- HarfangLab
- Legal name
- HarfangLab
- Website
- https://harfanglab.io
- Company type
- Private
- Founded year
- 2018
- Operating status
- Operating
- Headcount range
- 51–100 employees
- Short description
- HarfangLab is a Paris-based European cybersecurity company founded in 2018 that sells EDR, EPP, and attack surface management software exclusively through an MSSP partner network to European enterprises and government buyers prioritizing data sovereignty.
- Ownership category
- akta.pro rank
HarfangLab industry classification
Industry- Product category
- Endpoint Security Software
- NAICS
- Computer Systems Design and Related Services (5415)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Endpoint Protection Platforms (EPP/NGAV) (HDADAEAD)
- akta.pro secondary industry
- Endpoint Security Managed Services (EDR/XDR) (BPAEADAH)
Keywords
Where HarfangLab is headquartered
LocationHeadquarters
- HQ city
- Paris
- HQ country
- France
- HQ region
- Europe
Offices1 record
Markets served
HarfangLab business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure
Revenue model
- Subscription-based Endpoint Security Solutions: HarfangLab generates revenue through subscription-based licensing of its cybersecurity platform. Plans are structured in tiers (Scout/ASM, Shield/EPP, Track/EDR) with bundle options (Harfang One, Guard). Pricing is based on number of endpoints, telemetry volume, plan length, and associated services. Both Cloud (SaaS) and On-Premises deployment options available.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Multi-year contract | Scout (ASM) - Attack Surface Management for vulnerability and Shadow IT discovery |
| Subscription | Multi-year contract | Shield (EPP) - Endpoint Protection Platform with antivirus, firewall, and device control |
| Subscription | Multi-year contract | Track (EDR) - Endpoint Detection and Response with detection engines, investigation and remediation jobs, File Integrity Monitoring |
| Subscription | Multi-year contract | Harfang One - All-in-one solution combining EPP and EDR |
| Subscription | Multi-year contract | Guard - Combined EPP and EDR package |
Go-to-market motion3 records
Distribution channels4 records
Marketing channels10 records
HarfangLab product offering
Product offeringCore offering
HarfangLab develops and sells an endpoint security platform that combines Attack Surface Management (ASM), Endpoint Protection Platform (EPP) and Endpoint Detection and Response (EDR) for protecting workstations and servers across Windows, Linux and macOS. The platform embeds multiple AI and signature-based detection engines and is sold via subscription either as Cloud SaaS or On-Premises deployment, with full feature parity including air-gapped environments. It targets European enterprises and regulated organizations with emphasis on data sovereignty, transparent YARA/Sigma rules and integration with leading SIEM/SOAR/CTI platforms.
Product overview
HarfangLab is a European cybersecurity company offering a modular platform architecture combining Attack Surface Management (ASM), Endpoint Protection Platform (EPP), and Endpoint Detection and Response (EDR). The core products are organized into three main offerings: Scout (ASM) for vulnerability assessment and Shadow IT discovery, Shield (EPP) for antivirus, firewall, and device control, and Track (EDR) for advanced detection and investigation. These can be purchased separately or bundled as Harfang One (all-in-one) or Guard (EPP + EDR combination). The EDR includes multiple specialized detection engines (YARA, Sigma, IOC, Ransomguard, Sidewatch) plus AI engines Ashley and Kio, and investigation/remediation tools. The platform supports both Cloud and On-Premises deployment with full feature parity.
Differentiator
Problem solved
Functional benefit
Brands
- Kio: Generative AI assistant for SOC analysts that responds to natural language queries, helps browse documentation, analyze security events, and accelerate investigations.
- Ashley
- HarfangLab EDR
- HarfangLab EPP
- HarfangLab ASM
- Scout
- Shield
- Track
- Guard
- Harfang One
- Ransomguard
- Sidewatch
Products and services
- Scout (Attack Surface Management)
Quantifiable outcome
- 54% of European businesses prioritize data sovereignty in cybersecurity purchasing decisions
- +4 more outcomes
Companies that use HarfangLab
Customer profileNamed customers15 records
Segments6 records
Ideal customer profiles4 records
HarfangLab technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration25 records
AI capability8 records
Feature15 records
HarfangLab partnerships and signals
Strategic signalPartnerships
17 partnerships are on record, tiered core, elite and engage.
- BleucoreBleu and HarfangLab deliver enterprise-grade endpoint security within a trusted Microsoft Azure environment, operated exclusively from France by Orange and Capgemini, ensuring data sovereignty and compliance for critical environments.
- IKARUScoreIKARUS and HarfangLab form a technological and commercial partnership offering independent, high-quality cybersecurity solutions designed and hosted 100% in Europe. HarfangLab integrates IKARUS antivirus database (40 years experience in virus and malware scanning) into its EPP.
- OVHcloudcoreOVHcloud and HarfangLab partnership plays a crucial role in industrializing the design and deployment of HarfangLab's endpoint protection solutions to provide a secure, scalable foundation.
- SekoiacoreSekoia.io and HarfangLab unite to deliver a unified and sovereign platform powered by Infinigate. The European Defense Platform accelerates and optimizes threat response by leveraging AI-powered SOC platform strengths.
- S3NScoreS3NS and HarfangLab empower public organizations and critical operators to deploy advanced cybersecurity within a SecNumCloud-qualified cloud, combining Google Cloud technology excellence and Thales compliance guarantees.
- AdvenseliteAdvens is a European leader in Cybersecurity. Their mySOC range offers operated operational security services. HarfangLab is a strategic partner, offering a sovereign Managed Detection & Response service protecting numerous hospitals and public entities.
- Athéo IngénierieeliteAthéo Ingénierie is a player in digital transformation of organizations, in IT infrastructures and data. Supports business players in digital transition to outsourced or hybrid infrastructures.
- AxianseliteAxians offers on-demand support and customized protection through SOLAR SOC, a sovereign solution for detecting and responding to security incidents.
- CapgeminieliteCapgemini delivers end-to-end services and solutions leveraging AI, cloud and data capabilities combined with deep industry expertise and partner ecosystem.
- HWG SababaeliteHWG Sababa is a 'Made in Italy' cybersecurity provider for IT, OT, and hybrid environments offering services from auditing (Offensive Security) to 24/7 SOC (HyperSOC) and incident response.
- LinkteliteLinkt supports businesses and local authorities in digital transformation with telecom solutions and cyber offering including sovereign managed SOC for continuous monitoring.
- Orange CyberdefenseeliteOrange Cyberdefense focuses on 'Building a safer digital society' with comprehensive cybersecurity services.
- E-SecureeliteE-Secure has been safeguarding digital health of businesses for over 25 years with approach based on prevention, diagnosis, and mitigation of digital risks including audits, penetration testing, governance, risk management, and managed services.
- Thales Cyber SolutionseliteThales Cyber Solutions acts as trusted third party in implementation of managed cybersecurity detection and response services, helping define best incident response service.
- Airbus ProtectengageAirbus Protect is an Airbus subsidiary bringing together all company expertise in cybersecurity, safety and sustainability services.
- AISIengageAISI is a cybersecurity expert for over 12 years, exclusively dedicated to strategic and operational security of French mid-sized organizations (SMEs, ETIs, and local public services).
- AKTEAengageAKTEA has been an expert in security and resilient architecture in South-West of France for over 15 years, specializing in infrastructure, security and unified communications.
Scale indicators11 records
Recent moves6 records
Expansion highlights5 records
HarfangLab competitors and assessment
Company assessmentDirect peers
- Sophos: UK-based endpoint and network security vendor (now under Thoma Bravo) with Intercept X EDR/EPP and a 100% channel-led MSSP model. Highly comparable business model and target customer set to HarfangLab.
- SentinelOne: AI-native Singularity Endpoint platform offering EDR, EPP, and XDR. Closely comparable to HarfangLab's Track/Shield/Scout portfolio, with a similar emphasis on autonomous detection and AI-driven analysis.
- Bitdefender: Romanian-rooted European cybersecurity vendor offering GravityZone EDR/EPP with strong channel presence. Closely comparable to HarfangLab in European DNA, sovereign data posture, and enterprise/MSSP go-to-market.
- CrowdStrike: Global leader in cloud-native endpoint detection and response with the Falcon platform. Directly competes with HarfangLab's Track EDR and Shield EPP across enterprise and mid-market, and is the primary scale benchmark for the category.
- Cybereason: AI-driven EDR/XDR vendor competing across enterprise and MSSP channels. Comparable to HarfangLab's Track offering, with overlapping emphasis on behavioral detection and SOC productivity.
- WithSecure: Finnish European cybersecurity vendor (spun out of F-Secure) offering Elements EDR/EPP with strong MSSP orientation. Closely comparable to HarfangLab in European sovereign positioning, regulatory DNA, and channel-led go-to-market.
- ESET: Slovak European cybersecurity vendor offering ESET PROTECT EDR/EPP across SMB and enterprise. Comparable in European sovereign positioning, multi-engine detection philosophy, and channel-led distribution.
- Trellix: Enterprise endpoint security platform (formed from FireEye + McAfee enterprise) competing in EDR, EPP, and XDR. Targets the same large enterprise and government buyers as HarfangLab's defense and public-sector accounts.
Broad incumbents
- Microsoft (Defender for Endpoint): Bundled endpoint protection inside the Microsoft 365 and Azure ecosystem. Competes indirectly with HarfangLab as a default, lower-friction option — particularly in mid-market — and sets a pricing floor across the category.
- Trend Micro: Global cybersecurity incumbent with a broad endpoint, network, and cloud security portfolio. Overlaps with HarfangLab's EDR/EPP but competes as part of a much wider platform, particularly in mid-market and enterprise.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat6 records
Key risks6 records
Key highlights7 records
Customer concentration
HarfangLab social profiles
Digital presenceHarfangLab compliance and trust
Trust signalCompliance3 records
HarfangLab financial estimates
Financial estimateRevenue estimate
Valuation estimate
HarfangLab leadership team
Management profileNumber of profiles
Profiles4 records
HarfangLab funding detail
Funding detailFunding overview
Funding rounds3 records
Investors3 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
HarfangLab M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about HarfangLab
What does HarfangLab do?
HarfangLab develops and sells an endpoint security platform that combines Attack Surface Management (ASM), Endpoint Protection Platform (EPP) and Endpoint Detection and Response (EDR) for protecting workstations and servers across Windows, Linux and macOS. The platform embeds multiple AI and signature-based detection engines and is sold via subscription either as Cloud SaaS or On-Premises deployment, with full feature parity including air-gapped environments. It targets European enterprises and regulated organizations with emphasis on data sovereignty, transparent YARA/Sigma rules and integration with leading SIEM/SOAR/CTI platforms.
Is HarfangLab a public or private company?
HarfangLab is a private company. It is classified as venture growth investor backed and is currently operating.
When was HarfangLab founded?
HarfangLab was founded in 2018. It employs 51 to 100 people.
Where is HarfangLab based?
HarfangLab is headquartered in Paris, France, in the Europe region.
How does HarfangLab make money?
One revenue line is on record: subscription-based Endpoint Security Solutions.
Who are HarfangLab's main competitors?
Direct peers on record are Sophos, SentinelOne, Bitdefender, CrowdStrike, Cybereason, WithSecure, ESET and Trellix. Broad incumbents are Microsoft (Defender for Endpoint) and Trend Micro.
Does HarfangLab have an API?
Yes. HarfangLab EDR is fully API-driven and built for interoperability, giving cyber experts complete control over their roadmap and operational environment. The API enables seamless correlation of data from various sources. HarfangLab provides DSM (Device Support Module) for parsing HarfangLab's security events in SIEM tools. The platform integrates with third-party solutions including SIEM (IBM QRadar, Splunk, Sekoia, Syslog), SOAR (Cortex Xsoar, TheHive, Shuffle), Threat Intelligence platforms (MISP, OpenCTI), and file analysis centers (VirusTotal, CAPE sandbox, GLIMPS). The API supports sending security events, telemetry, logs, and receiving detection rules and IOCs. Developer documentation is at No URL provided.
What industry is HarfangLab in?
HarfangLab's product category is Endpoint Security Software. Its primary akta.pro industry code is HDADAEAD, Endpoint Protection Platforms (EPP/NGAV), with a secondary code of BPAEADAH, Endpoint Security Managed Services (EDR/XDR). Its NAICS code is 5415 and its SIC code is 7372.